Script for hosts, numbers of hosts and users connected to squid server

arunabh_biswas · 08-25-2010, 07:53 AM

Dear Experts,

Good evening.

I've 2 squid proxy servers running on SLES 9 (SQUID 2.5) and CentOS 5.5 (SQUID 2.7) respectively. Users are accessing internet after authenticating via ldap server.

I've 2 scripts which i use to find out which hosts are connected to the proxy server and what is the total number of them. Both scripts working fine with SLES 9 but doesn't show the desired results with CentOS. It shows only 2-3 hosts in output, though the actual count is more than this.

Contents of scripts are:

1) Hosts those are connected to proxy server

netstat -a -n | grep 3128|cut -d ' ' -f 25|cut -d ':' -f 1|sort -u

2) Total no of hosts are connected to proxy server

netstat -a -n | grep 3128|cut -d ' ' -f 25|cut -d ':' -f 1|sort -u|wc -l

Does this scripts need some modification to work with CenOS ?

Can anybody suggest me to write a script to findout the name of users (ldap users) those are authenticated at present and accessing squid server ?

Pls suggest.

Thanks
Arunabh

grail · 08-25-2010, 08:14 AM

Well this can put all your script together:

Code:

netstat -a -n | awk '/3128/ && !_[gensub(/:.*/,"","1",$5)]++{}END{for(x in _)print x;print "total connected: "length(_)}'

Not sure about the ldap user part. How would you do it manually? (ie one command at a time)

arunabh_biswas · 08-25-2010, 11:31 PM

Quote:

Originally Posted by grail

Well this can put all your script together:

Code:

netstat -a -n | awk '/3128/ && !_[gensub(/:.*/,"","1",$5)]++{}END{for(x in _)print x;print "total connected: "length(_)}'

Not sure about the ldap user part. How would you do it manually? (ie one command at a time)

Thanks GRAIL for your reply,

I ran this script on CentOS, it throws the output with errors. The hosts which it displays is aproximately correct but i don't understand the error message. Error message is

Quote:

[root@backupserver ~]# netstat -a -n | awk '/3128/ && !_[gensub(/:.*/,"","1",$5)]++{}END{for(x in _)print x;print "total connected: "length(_)}'
172.19.27.120
172.19.27.93
0.0.0.0
172.19.27.113
172.19.27.69
172.19.27.108
awk: cmd. line:1: (FILENAME=- FNR=107) fatal: attempt to use array `_' in a scalar context

For finding out the authenticated LDAP users, if possible kindly give a separate script for ldap authenticated users.

Thanks
Arunabh

grail · 08-26-2010, 12:01 AM

I believe the error is due to an incompatibility with your version of awk. Small change to fix is:

Code:

netstat -a -n | awk '/3128/ && !_[gensub(/:.*/,"","1",$5)]++{sum++}END{for(x in _)print x;print "total connected: "sum}'

Quote:

For finding out the authenticated LDAP users, if possible kindly give a separate script for ldap authenticated users.

happy to give a separate script but you will need to tell me how you do it without a script, ie what commands do you issue?

arunabh_biswas · 08-28-2010, 03:34 AM

Dear Grail,

Thanks.. It seems working. When I run the command it gives the below output..

[root@backupserver ~]# netstat -a -n | awk '/3128/ && !_[gensub(/:.*/,"","1",$5)]++{sum++}END{for(x in _)print x;print "total connected: "sum}'
172.19.27.52
172.19.27.53
0.0.0.0
172.19.27.122
total connected: 4

But one thing i want to ask !! Why it is counting 0.0.0.0 as this not a valid host (it implies the whole network, i guess !!). Can we exclude this..

Regarding finding out LDAP authenticated users.........
I'm running the below command and get this from the output...is there somehow any way to to achive this using this command.....

In the below output...usernames are deepak, brijesh, anuj...I've edited the output..

[root@backupserver ~]# tail -f /var/log/squid/access.log | awk '{print$3 " " $8 " " $7}'
172.19.27.52 anuj http://www.gojiyo.com/assets_v2/imag...e/homebg_3.jpg
172.19.27.52 anuj http://www.gojiyo.com/assets_v2/imag...e/homebg_3.jpg
...........................
..............................
...............................
172.19.27.59 deepak http://yahoo.com/
172.19.27.59 deepak s.yimg.com:443
172.19.27.53 brijesh www.irctc.co.in:443
172.19.27.53 brijesh www.irctc.co.in:443
172.19.27.53 brijesh www.irctc.co.in:443
172.19.27.59 deepak s.yimg.com:443
..................................
...............................
172.19.27.59 deepak row.bc.yahoo.com:443
172.19.27.59 deepak rtb.pclick.yahoo.com:443
172.19.27.52 anuj http://www.gojiyo.com/assets_v2/imag...e/homebg_6.jpg
172.19.27.52 anuj http://www.gojiyo.com/assets_v2/imag...e/homebg_6.jpg
............................
...........................
172.19.27.52 anuj http://www.gojiyo.com/assets_v2/imag...e/homebg_6.jpg
172.19.27.53 brijesh infinity.icicibank.co.in:443
172.19.27.53 brijesh infinity.icicibank.co.in:443
172.19.27.53 brijesh infinity.icicibank.co.in:443
172.19.27.53 brijesh infinity.icicibank.co.in:443
172.19.27.59 deepak login.yahoo.com:443

Regards
Arunabh

grail · 08-28-2010, 04:11 AM

Quote:

But one thing i want to ask !! Why it is counting 0.0.0.0 as this not a valid host (it implies the whole network, i guess !!). Can we exclude this..

It is of course always your choice should you wish to exclude something, but awk hasn't made any decisions. It simply has shown you anywhere that has
the port you are looking for on the entire line. Obviously there is a line where the port number is there and 0.0.0.0 is in field $5

As for your ldap users, I am guessing you wish to look for users that are registered on the ip addresses we just found.

Therefore your choices would be:

1. Output previous script to a file and use as input to find the names you are after.

2. Output values from first script into variable and then look for those in log file.

3. Include log file as a second input into awk and heave it look for them as well as output your count.